CodeHarden
NestJS · Drizzle ORM · PostgreSQL · Redis · BullMQ · Claude Agent SDK · GitHub App · Next.js
CodeHarden is a code-security scanner delivered as a SaaS: connect a GitHub repository, pick a scope, and an LLM-based engine runs a full audit across 44 detection classes - injection, crypto, CSRF/CORS, security headers, dependencies, IaC/CI, secret leakage and more - each mapped to OWASP and ASVS. Every finding comes with file:line evidence and a fix suggestion: machine-readable Markdown your AI agent can consume directly, and a PDF your manager can read.
The whole product turns on one hard-won lesson. When you drive static analysis with an LLM, the detection rules you give it become ground truth - and a wrong rule is worse than a missing one, because it both hides real bugs and invents ones that are not there. So the engine is built on rules where every technical claim is verified against a primary source: the spec text, the framework source, the RFC. "Sounds right" does not ship.
I am deliberate about scope too. CodeHarden audits static code and configuration; it does not do live, network or penetration testing, and every report states that plainly rather than implying a coverage it does not have. Pricing is per scan rather than per seat, which fits agencies, freelancers and pre-launch audits. The backend is NestJS with a BullMQ worker running the Claude Agent SDK. It is live at codeharden.com.
Highlights
- 44 detection classes mapped to OWASP and ASVS
- Agent-ready output: file:line evidence and fixes in Markdown, plus PDF
- Honest, declared scope: static code and config, no live/network/pentest
- Per-scan pricing rather than per-seat
Written about this